@feltdb/core 0.8.3 → 0.8.5

package/dist/create/server-source/crates/feltdb-server/src/auth.rs

@@ -40,6 +40,17 @@ pub struct ApiKeyRecord {
     pub namespaces: Vec<String>,
     #[serde(default)]
     pub revoked: bool,
+    /// The worker this credential *is*, when it is a worker credential.
+    ///
+    /// A key without one authenticates as a service, which is what every key
+    /// did before this field existed and what every key without it still does.
+    /// A key with one authenticates as `Subject::Worker(worker_id)` and is
+    /// thereby **narrower**, not wider: the worker lifecycle routes compare the
+    /// authenticated subject against the `worker_id` in the request body, so
+    /// such a credential can act as exactly one worker and no other, and cannot
+    /// satisfy a check that requires a human or service subject.
+    #[serde(default)]
+    pub worker_id: Option<String>,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -104,6 +115,9 @@ impl KeyStore {
                             scopes: token.scopes,
                             namespaces: vec![token.namespace],
                             revoked: false,
+                            // Legacy credentials predate worker identity and
+                            // stay services, which is what they already were.
+                            worker_id: None,
                         });
                     }
                     (records, true)
@@ -141,12 +155,25 @@ impl KeyStore {
                     .iter()
                     .any(|allowed| allowed == "*" || allowed == namespace);
                 if namespace_allowed && verify_api_key(token, &record.hash) {
-                    Some(Principal {
-                        key_id: record.id.clone(),
-                        scopes: record.scopes.clone(),
-                        subject_type: "service".into(),
-                        identity_id: None,
-                        session_id: None,
+                    // The credential decides the subject type. A worker
+                    // credential can never present as a service and a service
+                    // credential can never present as a worker, because neither
+                    // the request nor any header participates in this choice.
+                    Some(match &record.worker_id {
+                        Some(worker) => Principal {
+                            key_id: record.id.clone(),
+                            scopes: record.scopes.clone(),
+                            subject_type: "worker".into(),
+                            identity_id: Some(worker.clone()),
+                            session_id: None,
+                        },
+                        None => Principal {
+                            key_id: record.id.clone(),
+                            scopes: record.scopes.clone(),
+                            subject_type: "service".into(),
+                            identity_id: None,
+                            session_id: None,
+                        },
                     })
                 } else {
                     None
@@ -159,6 +186,21 @@ impl KeyStore {
         name: String,
         scopes: Vec<String>,
         namespaces: Vec<String>,
+    ) -> Result<CreatedApiKey, String> {
+        self.create_for_worker(name, scopes, namespaces, None)
+    }
+
+    /// Issue a credential that authenticates as one specific worker.
+    ///
+    /// `worker_id` of `None` produces an ordinary service credential, so this
+    /// is the one construction path and [`KeyStore::create`] is the common case
+    /// spelled out.
+    pub fn create_for_worker(
+        &self,
+        name: String,
+        scopes: Vec<String>,
+        namespaces: Vec<String>,
+        worker_id: Option<String>,
     ) -> Result<CreatedApiKey, String> {
         let secret: String = rand::thread_rng()
             .sample_iter(&Alphanumeric)
@@ -185,6 +227,7 @@ impl KeyStore {
                 scopes,
                 namespaces,
                 revoked: false,
+                worker_id,
             });
         self.persist()?;
         Ok(CreatedApiKey { id, secret: token })
@@ -266,13 +309,11 @@ fn verify_api_key(token: &str, stored_hash: &str) -> bool {
             .is_ok();
     }
 
-    PasswordHash::new(stored_hash)
-        .ok()
-        .is_some_and(|parsed| {
-            Argon2::default()
-                .verify_password(token.as_bytes(), &parsed)
-                .is_ok()
-        })
+    PasswordHash::new(stored_hash).ok().is_some_and(|parsed| {
+        Argon2::default()
+            .verify_password(token.as_bytes(), &parsed)
+            .is_ok()
+    })
 }
 
 #[cfg(test)]
@@ -341,4 +382,114 @@ mod tests {
         assert!(migrated.contains("managed-instance"));
         let _ = fs::remove_file(path);
     }
+
+    // ------------------------------------------------------------------
+    // Worker identity.
+    //
+    // The whole worker security boundary rests on one thing: which subject a
+    // credential authenticates as. That is decided here, by the stored
+    // credential alone — no request field, header or body participates — so
+    // these tests are the root of the boundary the workload lifecycle routes
+    // enforce further up.
+    // ------------------------------------------------------------------
+
+    fn key_store(name: &str) -> (PathBuf, KeyStore) {
+        let path = std::env::temp_dir().join(format!(
+            "feltdb-worker-identity-{name}-{}-{}.json",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        let _ = fs::remove_file(&path);
+        let store = KeyStore::load(&path).unwrap();
+        (path, store)
+    }
+
+    #[test]
+    fn a_worker_credential_authenticates_as_that_one_worker() {
+        let (path, store) = key_store("worker");
+        let key = store
+            .create_for_worker(
+                "extractor".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+                Some("worker-x".into()),
+            )
+            .unwrap();
+
+        let principal = store
+            .authenticate(&key.secret, "default")
+            .expect("authenticates");
+        assert_eq!(principal.subject_type, "worker");
+        assert_eq!(
+            principal.identity_id.as_deref(),
+            Some("worker-x"),
+            "the worker it is, not the key it uses, is the identity"
+        );
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn a_service_credential_cannot_present_as_a_worker() {
+        let (path, store) = key_store("service");
+        let key = store
+            .create(
+                "control-plane".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+            )
+            .unwrap();
+
+        let principal = store
+            .authenticate(&key.secret, "default")
+            .expect("authenticates");
+        assert_eq!(
+            principal.subject_type, "service",
+            "a key issued without a worker is a service, exactly as before this field existed"
+        );
+        assert_eq!(principal.identity_id, None);
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn worker_identity_survives_a_restart_of_the_credential_store() {
+        let (path, store) = key_store("reload");
+        let key = store
+            .create_for_worker(
+                "extractor".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+                Some("worker-x".into()),
+            )
+            .unwrap();
+        drop(store);
+
+        // A credential that forgot which worker it was on restart would silently
+        // downgrade to a service and start failing the identity check.
+        let reopened = KeyStore::load(&path).unwrap();
+        let principal = reopened
+            .authenticate(&key.secret, "default")
+            .expect("authenticates");
+        assert_eq!(principal.subject_type, "worker");
+        assert_eq!(principal.identity_id.as_deref(), Some("worker-x"));
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn a_revoked_worker_credential_authenticates_as_nothing() {
+        let (path, store) = key_store("revoked");
+        let key = store
+            .create_for_worker(
+                "extractor".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+                Some("worker-x".into()),
+            )
+            .unwrap();
+        assert!(store.revoke(&key.id).unwrap());
+        assert!(
+            store.authenticate(&key.secret, "default").is_none(),
+            "revocation is not weakened by carrying a worker identity"
+        );
+        let _ = fs::remove_file(path);
+    }
 }